It's a good question. Currently, the API that is used for unsolicited communication with a customer (or other party role) is indeed TMF681, which basically is intended to wrap and abstract the actual way in which a message is sent (via SMS, voice message, email, other). But perhaps for sending OTPs the TMF681 API is over--qualified.
On the other hand, if you want a record of the fact that OTPs were sent, and flexibility in how they were sent, you'll end up re-inventing TMF681.
Interesting to hear what @Bruno Fernandes (lead for Digital ID API) has to say about this.
------------------------------
Jonathan Goldberg
Amdocs Management Limited
Any opinions and statements made by me on this forum are purely personal, and do not necessarily reflect the position of the TM Forum or my employer.
------------------------------